Steadefi

Summary

The deposit() function directly updates on-chain storage upon receiving a deposit transaction, however the token transfer may revert before completing. This could leave storage in an invalid state.

Vulnerability Details

When a user calls deposit(), storage modifications like updating the deposit cache occur immediately. But the token transfer instruction executes separately, and has the potential to revert prior to completion. If this occurs, storage would be prematurely updated, risking inconsistencies.

Reproduction Steps:

1. User deposits tokens by calling deposit()

2. Function triggers storage updates like to the deposit cache

3. Token transfer executes independently

4. Before transfer settles, it reverts

5. But storage was already modified out of sync

Impact

Storage inconsistencies if transfer reverts after updates

Tools Used

Manual Review

Recommendations

Defer storage changes until after validating token arrival